1007-00007 · Vantage Mobility Systems Corp · Memos & Analysis

regulatory-applicability-memo.docx DOCUMENT Finance & Banking

9 / 12 ← → ✕

Contract analysis Extract to table

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT

Date: October 18, 2022

To:

Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP

Diana Kowalski, Chief Privacy Officer, Vantage Mobility Systems Corp.

Thomas Langford, General Counsel, Vantage Mobility Systems Corp.

From:

Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP

Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP

Re: Regulatory Applicability Analysis — VMS-Meridian Data-Sharing Arrangement (Michigan Identity Theft Protection Act, CCPA/CPRA, DPPA)

Matter No.: 1007-00007

Right-click to update Table of Contents

I. Executive Summary

The purpose of this memorandum is to analyze the applicability of three key privacy and data protection statutes to the proposed data-sharing arrangement between Vantage Mobility Systems Corp. ("VMS") and Meridian Telematics Solutions, Inc. ("Meridian"), under which Meridian would receive and process connected-vehicle telemetry and in-cabin sensor data generated by VMS's VantageLink platform. This analysis is intended to inform the negotiation of the Data Processing Agreement ("DPA") currently under discussion between the parties and to identify regulatory risks that should be addressed through specific contractual provisions.

The three statutes analyzed herein are: (1) the Michigan Identity Theft Protection Act ("Michigan ITPA"), MCL §§ 445.61 et seq.; (2) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), Cal. Civ. Code §§ 1798.100 et seq.; and (3) the federal Drivers' Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721 et seq. Each statute implicates a distinct set of compliance obligations, and the interplay among them creates a layered regulatory framework that the DPA must accommodate.

Our principal conclusions are as follows:

Michigan ITPA. The Michigan ITPA is applicable to the proposed arrangement to the extent that VMS transfers personal identifying information — including vehicle identification number ("VIN")-linked geolocation data and VIN-linked seat occupancy data — to Meridian. The statute imposes security breach notification requirements and an obligation to implement and maintain reasonable security measures. Although the Michigan ITPA does not establish a formal "data processor" regime comparable to that found in the CCPA/CPRA, VMS's obligations as the data owner extend to ensuring that third-party processors receiving personal identifying information maintain adequate security. The DPA must contractually impose Michigan ITPA-compliant security and breach notification obligations on Meridian.

CCPA/CPRA. The CCPA/CPRA is applicable to the proposed arrangement. VMS qualifies as a "business" under the statute based on its annual revenue, its operations in California, and the volume of California consumer data it processes. An estimated 112,000 California-registered vehicles are among the approximately 800,000 vehicles whose owners and lessees have opted into VMS's Connected Insights data-sharing program, representing approximately 14% of the relevant data subject population. VIN-linked GPS and geolocation data, seat occupancy data, and the remaining twelve categories of vehicle telemetry data — when transmitted with or linkable to VINs — likely constitute "personal information" under the CCPA/CPRA. GPS/geolocation data additionally qualifies as "sensitive personal information" under the CPRA. The DPA must include the full suite of service provider contractual provisions mandated by Cal. Civ. Code § 1798.100(d), and the arrangement must be carefully structured to preserve Meridian's classification as a "service provider" rather than a "third party" — particularly with respect to Meridian's development of derivative analytics products.

DPPA. The DPPA is potentially applicable to the proposed arrangement to the extent that VMS data includes motor vehicle records or personal information derived from state Department of Motor Vehicles ("DMV") records linked to vehicle owners and lessees through VINs. The DPPA's applicability turns on the data provenance of VMS's owner/lessee identification information — specifically, whether VMS "obtained" such information from motor vehicle records or independently collected it through its own consumer registration process. The scope of the DPPA may limit its direct applicability, but the potential for overlap warrants the inclusion of protective DPA provisions addressing DPPA compliance. An alternative structural approach — de-linking VIN data from personal information derived from motor vehicle records before transferring data to Meridian — should be evaluated for technical feasibility.

Key Recommendation. The DPA should include statute-specific compliance provisions addressing all three regulatory frameworks. The specific recommendations are set forth in detail in Section VI of this memorandum and encompass breach notification timelines, service provider contractual terms, data de-identification and aggregation standards, consumer rights facilitation obligations, audit rights, sub-processor flow-down requirements, liability and indemnification provisions, and data retention limitations.

II. Background and Factual Context

A. The Parties

Vantage Mobility Systems Corp. VMS is a Delaware corporation headquartered at 4700 Automation Boulevard, Suite 300, Auburn Hills, Michigan 48326. VMS designs, manufactures, and sells connected-vehicle hardware modules and integrated mobility platforms to automotive original equipment manufacturers ("OEMs") and aftermarket distributors. VMS's flagship product is the VantageLink system, a connected-vehicle telematics module that enables real-time data collection, remote diagnostics, and over-the-air software updates. VMS is a portfolio company of Northgate Capital Partners LLC, which holds a 72% controlling equity stake acquired in November 2019 through Northgate Fund II, L.P. VMS's fiscal year 2021 revenue was approximately $385 million. VMS employs approximately 1,200 individuals across its operations.

VMS's Connected Insights program, the vehicle-data-sharing program relevant to this analysis, allows owners and lessees of VantageLink-equipped vehicles to voluntarily opt into the sharing of vehicle telemetry and in-cabin sensor data. As of the date of this memorandum, approximately 800,000 of the 2.4 million vehicles in VMS's total connected-vehicle install base have opted into the Connected Insights program.

Meridian Telematics Solutions, Inc. Meridian is a Delaware corporation headquartered at 1250 Embarcadero Way, Suite 400, Palo Alto, California 94303, with a data operations center located at 8900 Research Park Drive, Building C, Austin, Texas 78759. Meridian provides cloud-based analytics and machine-learning services to automotive OEMs and Tier 1 suppliers. Meridian employs approximately 340 individuals and reported annual recurring revenue ("ARR") of approximately $78 million as of the second quarter of 2022. Meridian's leadership team includes Priya Ramanathan (Chief Executive Officer), Julian Voss (Chief Technology Officer), and Lena Torrance (Head of Data Governance).

B. The Proposed Data-Sharing Arrangement

On August 5, 2022, VMS and Meridian executed a non-binding letter of intent ("LOI") outlining the principal terms of a data-sharing and analytics arrangement. Under the proposed arrangement, Meridian would receive and process fourteen (14) categories of vehicle telemetry and in-cabin sensor data from VMS's VantageLink platform. The fourteen data categories are as follows:

1. GPS/geolocation

2. Vehicle speed

3. Acceleration/deceleration

4. Braking events

5. Tire pressure

6. Engine diagnostic codes

7. Fuel consumption

8. In-cabin temperature

9. In-cabin humidity

10. Seat occupancy

11. Seatbelt status

12. Ambient noise levels

13. Windshield wiper activation

14. Headlight/taillight status

The data would be collected from approximately 800,000 active VantageLink-equipped vehicles whose owners and lessees have opted into VMS's Connected Insights data-sharing program. The estimated data volume to be transmitted to Meridian is approximately 4.2 terabytes per day.

The principal commercial terms outlined in the LOI are as follows: Meridian would pay VMS an annual license fee of $6.5 million, payable in quarterly installments of $1,625,000 per quarter. Meridian would additionally pay VMS a 3.5% royalty on net revenue from derivative analytics products sold by Meridian to third parties that incorporate VMS-sourced data. The base term of the arrangement is three (3) years, with two (2) optional one-year renewal periods. The total base-term contract value is $19.5 million.

C. VMS Internal Data Governance Classifications

VMS's internal data governance policy establishes a tiered classification system for vehicle-generated data. Under this system, GPS/geolocation data and seat occupancy data are classified as "Sensitive Vehicle Data" when combined with vehicle identification numbers ("VINs"), because the combination of these data elements with a VIN enables linkage to identifiable individuals — specifically, the registered owner or lessee of the vehicle in question. VMS's data governance policy recognizes that VINs serve as a persistent identifier that, through cross-referencing with state motor vehicle registration databases and VMS's own customer records, permits the identification of a specific individual and the attribution of behavioral and locational data to that individual.

The remaining twelve (12) data categories — vehicle speed, acceleration/deceleration, braking events, tire pressure, engine diagnostic codes, fuel consumption, in-cabin temperature, in-cabin humidity, seatbelt status, ambient noise levels, windshield wiper activation, and headlight/taillight status — are classified as non-sensitive vehicle telemetry when not combined with identifying information such as VINs. However, when transmitted alongside VINs or in combination with Sensitive Vehicle Data, these categories may take on an identifying character, a point that is addressed in detail in the statutory analyses below.

D. Sub-Processing Arrangements

Meridian has proposed utilizing Cloudvault Infrastructure, Inc. ("Cloudvault") as a sub-processor for purposes of hosting and processing VMS data. Cloudvault is a Nevada corporation headquartered in Reno, Nevada, and operates data centers in Reno, Nevada and Columbus, Ohio (7400 Crossroads Boulevard, Columbus, Ohio 43219). Meridian and Cloudvault are parties to an existing master services agreement executed on March 1, 2021. Under the proposed arrangement, Cloudvault's "AutoCloud" platform would host and process VMS data within Cloudvault's domestic data centers.

Meridian has disclosed the possibility of a future migration of certain data processing operations to Cloudvault's Dublin, Ireland facility (Unit 12, Parkwest Business Campus, Dublin 12, Ireland). The cross-border data transfer implications of such a migration — including any applicability of the EU General Data Protection Regulation ("GDPR") and related international transfer mechanisms — are addressed in a separate memorandum and are outside the scope of this analysis.

E. Geographic Distribution of Data Subjects

Of the approximately 800,000 vehicles whose owners and lessees have opted into the Connected Insights program, approximately 112,000 are registered in the State of California. This represents approximately 14% of the total data subject population. This concentration of California-registered vehicles is a primary driver of the CCPA/CPRA analysis set forth in Section IV of this memorandum, as it establishes a substantial California consumer population whose personal information would be shared with Meridian under the proposed arrangement.

The remaining vehicles in the Connected Insights program are distributed across other U.S. states and Canadian provinces. No European Union data subjects are currently within the scope of the proposed data-sharing arrangement, although the potential Cloudvault Dublin migration discussed above could alter this assessment.

F. Governing Law

The parties have agreed that the DPA will be governed by and construed in accordance with the laws of the State of Michigan. The implications of this governing law selection for CCPA/CPRA compliance are discussed in Section VI.D below.

III. Michigan Identity Theft Protection Act (MCL §§ 445.61 *et seq.*)

A. Statutory Overview

The Michigan Identity Theft Protection Act was enacted to protect Michigan residents from identity theft and to establish a framework for the responsible handling of personal identifying information by persons and agencies that own, license, or maintain such information. The statute's key operative provisions are found in MCL §§ 445.63 through 445.77 and include the following principal requirements:

Security Breach Notification. MCL § 445.72 requires that a person or agency that owns or licenses data that includes personal identifying information of a Michigan resident must provide notice of a security breach to each Michigan resident whose personal identifying information was subject to unauthorized access and acquisition. The notice must be provided "without unreasonable delay." The statute permits reasonable delay in order to allow the person or agency to determine the scope of the breach and restore the integrity of the data system, but does not specify a fixed hour-count or day-count notification deadline.

Security Measures. The Michigan ITPA imposes a duty on persons and agencies that own or license data containing personal identifying information to implement and maintain reasonable security measures to protect that information from unauthorized access, acquisition, destruction, use, modification, or disclosure. The statute does not prescribe specific technical standards, leaving the determination of "reasonableness" to be assessed in light of the circumstances, including the sensitivity of the data, the size and complexity of the entity, and the cost of available security measures.

Definition of Personal Identifying Information. The statute defines "personal identifying information" to include, among other things, an individual's name, Social Security number, driver's license number, state personal identification card number, and other enumerated identifiers. MCL § 445.63. The statute's enumerated list is not expressly limited to the categories listed, and the overall protective purpose of the statute supports a reading that encompasses data combinations that enable the identification of specific individuals.

Scope. The Michigan ITPA applies to any "person" or "agency" that owns or licenses data that includes personal identifying information of a Michigan resident. The term "person" is defined broadly and includes corporations, partnerships, associations, and other legal entities. The statute does not contain an express jurisdictional limitation tied to the location of the person or agency; rather, the nexus is to the residency of the individuals whose personal identifying information is at issue.

B. Applicability to the VMS-Meridian Arrangement

1. Does VMS Data Constitute "Personal Identifying Information" Under the Michigan ITPA?. The threshold question is whether the data that VMS proposes to transfer to Meridian constitutes "personal identifying information" within the meaning of the Michigan ITPA. We address this question with respect to the specific data categories at issue.

VINs Alone. Vehicle identification numbers are not explicitly enumerated in the Michigan ITPA's definition of personal identifying information. A VIN is a unique 17-character alphanumeric code assigned to a motor vehicle at the time of manufacture and does not, standing alone, identify a natural person. However, VINs can be cross-referenced with state motor vehicle registration databases — including the Michigan Secretary of State's records — to identify the registered owner or lessee of a vehicle. This cross-referencing capability transforms a VIN from a vehicle identifier into a link to an identifiable individual. While the Michigan ITPA's definition of personal identifying information is framed in terms of enumerated identifiers associated with a specific individual, the combination of a VIN with additional data elements (as discussed below) effectively creates a data set that functions as personal identifying information.

VIN-Linked GPS/Geolocation Data. When GPS/geolocation data is combined with VIN data, the resulting data set reveals the real-time and historical location and movement patterns of an identifiable individual — namely, the registered owner or lessee of the vehicle associated with the VIN. This combination arguably constitutes personal identifying information under the Michigan ITPA because it can be used, in conjunction with publicly available motor vehicle registration records, to identify a specific individual and to reveal sensitive details about that individual's daily activities, residential location, places of employment, and associations. Michigan courts have not directly addressed whether VIN-linked geolocation data constitutes personal identifying information under the Michigan ITPA, but the statute's protective purpose and its broad definitional framework support this interpretation.

VIN-Linked Seat Occupancy Data. Seat occupancy data reveals whether a vehicle is occupied and the number of occupants at any given time. When combined with VIN data and geolocation data, seat occupancy data may enable inferences about an identifiable individual's daily patterns, household composition, cohabitants, and personal habits. For example, the combination of VIN-linked geolocation data showing a vehicle at a residential address during nighttime hours, combined with seat occupancy data indicating two occupants, could reveal information about an individual's domestic arrangements. This type of inferential profiling capability strengthens the argument that VIN-linked seat occupancy data, in combination with other data elements, constitutes personal identifying information within the statute's protective scope.

Analysis. VMS's own internal data governance classification system recognizes that GPS/geolocation data and seat occupancy data become "Sensitive Vehicle Data" when combined with VINs. This internal classification aligns with the Michigan ITPA's protective scope. The transfer of VIN-linked data sets to Meridian — encompassing geolocation data, seat occupancy data, and potentially other telemetry data that acquires an identifying character through VIN linkage — brings these data elements within the reach of the Michigan ITPA's security and breach notification requirements. We conclude that the Michigan ITPA applies to the extent VMS transfers VIN-linked geolocation data and VIN-linked seat occupancy data to Meridian, and may apply more broadly to other VIN-linked data categories depending on the identifiability analysis applicable in each case.

2. VMS's Obligations as Data Owner/Licensor. VMS, as the entity that owns and licenses the connected-vehicle data generated by the VantageLink platform, bears primary obligations under the Michigan ITPA. These obligations include:

Security Measures. VMS is required to implement and maintain reasonable security measures to protect personal identifying information from unauthorized access, acquisition, destruction, use, modification, or disclosure. This obligation extends to the manner in which VMS stores, transmits, and shares personal identifying information — including the transfer of such information to Meridian under the proposed arrangement. VMS must ensure that the security protections governing the data transfer are commensurate with the sensitivity of the data and the risk of unauthorized access.

Breach Notification. In the event of a security breach affecting personal identifying information of Michigan residents, VMS is obligated to provide notice to each affected Michigan resident "without unreasonable delay." MCL § 445.72(1). The statute permits a reasonable delay to allow VMS to determine the scope of the security breach and to restore the reasonable integrity of the data system, but the notification must be provided promptly once these preliminary assessments are completed. Notably, the statute does not prescribe a specific hour-count for breach notification. This contrasts with VMS's proposed 24-hour contractual notification standard and Meridian's proposed 72-hour notification standard. The contractual timeline adopted in the DPA should be set at a level that allows VMS to receive timely notice from Meridian and, in turn, satisfy its own statutory obligation to notify affected Michigan residents "without unreasonable delay."

Third-Party Processor Oversight. While the Michigan ITPA does not establish a formal "data processor" or "service provider" regime comparable to the frameworks established by the CCPA/CPRA or the GDPR, VMS's obligations as the data owner extend to ensuring that third parties processing personal identifying information on its behalf maintain adequate security. A failure by Meridian to protect VMS data could expose VMS to liability under the statute, as VMS remains the party that "owns or licenses" the data in question.

3. Flow-Down Requirements to Meridian as Data Processor. As noted above, the Michigan ITPA does not contain an express statutory requirement for contractual flow-down provisions governing the relationship between a data owner and a third-party processor. The statute places the burden of compliance on the entity that owns or licenses the data, without prescribing specific contractual mechanisms for managing downstream processing relationships. However, the practical effect of this framework is that VMS must take affirmative steps to ensure that Meridian's processing activities do not compromise VMS's ability to meet its statutory obligations.

We recommend that the DPA serve as the contractual mechanism for imposing Michigan ITPA-compliant obligations on Meridian. Specifically, the DPA should require Meridian to implement and maintain reasonable security measures consistent with the Michigan ITPA's standards, to promptly notify VMS of any actual or suspected security breach affecting Michigan residents' personal identifying information, and to cooperate with VMS in investigating and remediating any such breach. The DPA should also require Meridian to flow down these obligations to any sub-processors, including Cloudvault.

C. Recommended DPA Provisions — Michigan ITPA Compliance

Based on the foregoing analysis, we recommend that the DPA include the following provisions addressing Michigan ITPA compliance:

1. Reasonable Security Measures. A contractual requirement for Meridian to implement and maintain reasonable security measures — consistent with the standards applicable under the Michigan ITPA — to protect VMS personal identifying information from unauthorized access, acquisition, destruction, use, modification, or disclosure. The DPA should specify minimum security requirements, including encryption standards, access controls, employee training, and incident response procedures, with reference to recognized industry frameworks (e.g., NIST Cybersecurity Framework, ISO/IEC 27001).

2. Breach Notification. A breach notification provision requiring Meridian to notify VMS of any actual or reasonably suspected security breach affecting personal identifying information of Michigan residents within a timeframe sufficient for VMS to meet its "without unreasonable delay" statutory obligation. This provision supports VMS's proposed 24-hour notification window in the DPA. Meridian's proposed 72-hour notification window introduces unacceptable risk that VMS may be unable to comply with its statutory obligations in a timely manner.

3. Indemnification. An indemnification provision requiring Meridian to indemnify, defend, and hold harmless VMS from and against any costs, damages, penalties, fines, and expenses (including reasonable attorneys' fees) arising from Meridian's failure to comply with Michigan ITPA requirements or with the Michigan ITPA-related provisions of the DPA.

4. Representations and Warranties. Representations from Meridian regarding its understanding of and compliance with applicable Michigan data protection law, including the Michigan ITPA, and an acknowledgment that Meridian will process VMS data in a manner consistent with VMS's obligations under the statute.

IV. California Consumer Privacy Act / California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 *et seq.*)

A. Statutory Overview

The California Consumer Privacy Act ("CCPA"), which took effect on January 1, 2020, and its successor amendments enacted through the California Privacy Rights Act ("CPRA"), which take effect on January 1, 2023 (with a look-back period to January 1, 2022), together establish the most comprehensive state-level consumer privacy framework in the United States. The CCPA/CPRA grants California residents (referred to as "consumers") a suite of substantive privacy rights and imposes corresponding obligations on for-profit businesses that collect, process, or share consumers' personal information.

The key consumer rights established by the CCPA/CPRA include: (1) the right to know what personal information a business collects and how it is used and shared; (2) the right to delete personal information held by a business and its service providers; (3) the right to opt out of the "sale" or "sharing" of personal information; (4) the right to correct inaccurate personal information (added by the CPRA); and (5) the right to limit the use and disclosure of "sensitive personal information" (added by the CPRA).

The CCPA/CPRA applies to for-profit entities doing business in California that meet one or more of the following thresholds: (a) annual gross revenue in excess of $25 million in the preceding calendar year; (b) annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or (c) deriving 50% or more of annual revenue from selling or sharing consumers' personal information.

The statute imposes specific contractual requirements on businesses that disclose personal information to "service providers" and "contractors" — entities that process personal information on behalf of a business pursuant to a written contract containing specified restrictive terms. The distinction between a "service provider" (or "contractor") and a "third party" is of critical importance: a transfer of personal information to a service provider or contractor is not a "sale" or "sharing" under the statute, whereas a transfer to a third party may constitute a "sale" or "sharing," triggering the consumer's right to opt out and other heightened compliance obligations.

B. Threshold Applicability Analysis

1. Does VMS Qualify as a "Business" Under CCPA/CPRA?. The CCPA/CPRA applies to "businesses," which are defined as for-profit legal entities that do business in the State of California and that satisfy one or more of the statute's threshold requirements. Cal. Civ. Code § 1798.140(d). We analyze each element below.

For-Profit Entity. VMS is a for-profit Delaware corporation. This element is satisfied.

Does Business in California. VMS operates in California in multiple respects: VantageLink-equipped vehicles are operated by consumers in California; VMS collects vehicle telemetry and in-cabin sensor data from California-based vehicles; and VMS has a commercial relationship with Meridian, a California-headquartered entity. VMS's operations in California are sufficient to establish that it "does business" in the state within the meaning of the statute.

Revenue Threshold. VMS's fiscal year 2021 revenue of approximately $385 million substantially exceeds the $25 million annual gross revenue threshold set forth in Cal. Civ. Code § 1798.140(d)(1)(A). This threshold is independently satisfied.

Consumer/Household Threshold. VMS collects personal information from approximately 112,000 California-registered vehicle owners and lessees through the Connected Insights program. This exceeds the 100,000 consumer/household threshold set forth in Cal. Civ. Code § 1798.140(d)(1)(B). This threshold is also independently satisfied.

Conclusion. VMS clearly qualifies as a "business" under the CCPA/CPRA. Both the revenue threshold and the consumer/household threshold are independently satisfied, and VMS conducts business in California. VMS is therefore subject to the full range of CCPA/CPRA obligations with respect to its collection, use, and disclosure of personal information relating to California consumers.

2. Does the VMS Data Constitute "Personal Information" Under CCPA/CPRA?. The CCPA/CPRA defines "personal information" in expansive terms as "information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(v). This definition encompasses not only traditional identifiers (name, address, Social Security number) but also data elements that can be linked to a consumer through intermediary identifiers, unique device or vehicle identifiers, and inferences drawn from other data points.

We analyze each relevant data category below.

VIN-Linked GPS/Geolocation Data. VINs are linked to specific vehicle owners and lessees through DMV registration records and VMS's own customer account information. GPS/geolocation data that is linked to a VIN identifies the precise physical location of an identifiable consumer — specifically, the registered owner or lessee of the vehicle — at a specific point in time. This data clearly constitutes "personal information" under the CCPA/CPRA because it "identifies, relates to, [and] is reasonably capable of being associated with" a particular consumer through the VIN linkage.

Furthermore, precise geolocation data is classified as "sensitive personal information" under the CPRA. Cal. Civ. Code § 1798.140(ae)(1)(A). Sensitive personal information is subject to additional restrictions under the CPRA, including the consumer's right to limit the use and disclosure of such information to purposes that are "reasonably necessary and proportionate" to the purposes for which the information was collected or processed. Cal. Civ. Code § 1798.121(a). This classification has significant implications for the permissible scope of Meridian's processing activities, as discussed further below.

VIN-Linked Seat Occupancy Data. Seat occupancy data, when linked to a VIN, may reveal information about household composition, passenger patterns, and daily routines of an identifiable consumer. This data can be "reasonably linked" to an identified consumer through the VIN and therefore constitutes personal information under the CCPA/CPRA. While seat occupancy data does not fall within the CPRA's enumerated categories of sensitive personal information, it remains subject to the statute's general protections for personal information.

Other Data Categories. The remaining twelve data categories — vehicle speed, acceleration/deceleration, braking events, tire pressure, engine diagnostic codes, fuel consumption, in-cabin temperature, in-cabin humidity, seatbelt status, ambient noise levels, windshield wiper activation, and headlight/taillight status — when transmitted alongside VINs or in conjunction with other identifying data elements, constitute personal information under the CCPA/CPRA. Each of these categories is "reasonably capable of being associated with" a particular consumer through the VIN linkage. Vehicle speed and braking event data, for example, reveal an identifiable consumer's driving behavior; engine diagnostic codes may reveal information about the consumer's vehicle maintenance patterns; and in-cabin temperature and humidity data may reflect environmental conditions chosen by or experienced by an identifiable consumer.

Analysis of All 14 Data Categories. All fourteen data categories identified in the LOI, when transmitted with or linkable to VINs, likely constitute personal information under the CCPA/CPRA. The breadth of the statute's definition — which encompasses information that "could reasonably be linked, directly or indirectly" to a consumer — captures the full range of VIN-linked telemetry and sensor data that VMS proposes to share with Meridian. GPS/geolocation data additionally qualifies as "sensitive personal information" under the CPRA, triggering enhanced protections and use limitations.

3. Significance of 112,000 California-Registered Vehicles. Approximately 112,000 of the 800,000 opted-in vehicles — representing approximately 14% of the total data subject population — are registered in California. This represents a substantial population of California consumers whose personal information would be shared with Meridian under the proposed arrangement.

It is important to note that the CCPA/CPRA does not impose a minimum California-consumer threshold as a condition for the statute's protections to apply to specific processing activities. The thresholds set forth in Cal. Civ. Code § 1798.140(d) are entity-level thresholds that determine whether a business is subject to the statute as a whole; once those thresholds are met, the statute's protections extend to all California consumer personal information processed by the business, regardless of the proportion of California consumers relative to the total consumer population. Accordingly, VMS's CCPA/CPRA obligations extend to all 112,000 California consumers whose data is included in the proposed data transfer, and the DPA must be structured to ensure compliance with respect to this entire population.

C. Meridian's Role Under CCPA/CPRA

1. Service Provider vs. Third Party vs. Contractor Classification. The classification of Meridian under the CCPA/CPRA — as a "service provider," a "contractor," or a "third party" — is a threshold question with far-reaching consequences for the structuring of the proposed arrangement and the DPA.

Service Provider Status. Under Cal. Civ. Code § 1798.140(ag), a "service provider" is a legal entity that processes personal information on behalf of a business and to which the business discloses a consumer's personal information for a business purpose, pursuant to a written contract that meets specific statutory requirements. The written contract must prohibit the service provider from: (a) selling or sharing the personal information; (b) retaining, using, or disclosing the personal information for any purpose other than performing the services specified in the contract, including any commercial purpose other than providing the services specified in the contract; and (c) retaining, using, or disclosing the personal information outside of the direct business relationship between the service provider and the business. The contract must also require the service provider to comply with applicable provisions of the CCPA/CPRA, to provide the same level of privacy protection as is required by the statute, and to grant the business the right to take reasonable and appropriate steps to ensure that the service provider's use of personal information is consistent with the business's CCPA/CPRA obligations.

Risk of Third-Party Classification. Under the proposed arrangement, Meridian would process VMS data to provide analytics services to VMS — a use that is consistent with service provider status. However, Meridian also intends to develop derivative analytics products for sale to third parties, subject to the 3.5% royalty described in the LOI. This secondary commercial use creates a significant risk that Meridian may be disqualified from "service provider" status under the CCPA/CPRA. If Meridian's derivative analytics products incorporate California consumers' personal information in identifiable form — i.e., if the derivative products retain VIN linkage or other identifying characteristics that permit the data to be "reasonably linked" to a consumer — Meridian's use of the data would extend beyond the scope of the services performed on VMS's behalf and would constitute a use for Meridian's own independent commercial purposes.

If Meridian is classified as a "third party" rather than a service provider, VMS's transfer of personal information to Meridian could constitute a "sale" or "sharing" of personal information under the CCPA/CPRA. Cal. Civ. Code § 1798.140(ad) (defining "sale" as disclosing personal information for monetary or other valuable consideration); Cal. Civ. Code § 1798.140(ah) (defining "sharing" as disclosing personal information for cross-context behavioral advertising). If the transfer constitutes a "sale" or "sharing," VMS would be required to provide California consumers with the right to opt out of such sale or sharing, prominently post a "Do Not Sell or Share My Personal Information" link on its website, and honor opt-out requests — obligations that would significantly complicate the operational and commercial structure of the arrangement.

Contractor Status Under CPRA. The CPRA introduces the additional classification of "contractor," which is similar to the service provider classification and carries substantially the same contractual requirements. Cal. Civ. Code § 1798.140(j). The contractor classification is available for entities to which a business makes available a consumer's personal information for a business purpose, pursuant to a written contract that includes the same restrictive terms required for service providers. If the DPA is executed after the CPRA's effective date (January 1, 2023), the contractor classification should be considered as an alternative or complement to the service provider classification.

Recommendation. The DPA must carefully delineate the scope of Meridian's permitted uses of VMS personal information and must contain all CCPA/CPRA-mandated service provider contractual provisions as set forth in Cal. Civ. Code § 1798.100(d). To preserve Meridian's service provider status and to avoid the risk that the data transfer will be classified as a "sale" or "sharing," derivative analytics product development must be structured to use only de-identified or aggregated data — not personal information in identifiable form. The DPA should include express prohibitions on the use of personal information (i.e., VIN-linked data) in any derivative product and should require Meridian to certify that its de-identification processes meet the CCPA/CPRA's statutory standard.

2. Sub-Processor Flow-Down (Cloudvault). The CCPA/CPRA requires service providers to notify the business of any sub-processor engagements and to ensure that sub-processors are contractually bound to the same restrictions that apply to the service provider. Cal. Civ. Code § 1798.140(ag)(2). Meridian's proposed use of Cloudvault as a sub-processor for hosting and processing VMS data on the AutoCloud platform triggers this requirement.

The DPA must include flow-down obligations requiring Meridian to: (a) notify VMS of its engagement of Cloudvault (and any other sub-processor) prior to the commencement of processing; (b) contractually bind Cloudvault to CCPA/CPRA-compliant terms that are no less restrictive than the terms imposed on Meridian in the DPA; and (c) remain liable to VMS for the acts and omissions of Cloudvault with respect to the processing of VMS personal information. VMS should also retain the right to object to the engagement of any sub-processor and to require Meridian to terminate sub-processing arrangements that do not meet VMS's compliance standards.

D. Specific CCPA/CPRA Compliance Obligations for the DPA

1. Contractual Provisions Required by Cal. Civ. Code § 1798.100(d). The CCPA/CPRA mandates that the written contract between a business and a service provider or contractor include specific provisions. The DPA must contain each of the following:

Prohibition on Selling or Sharing. The DPA must prohibit Meridian from selling or sharing personal information received from VMS. This prohibition must be absolute and unqualified, extending to all personal information received, derived, or generated from the VMS data transfer.

Purpose Limitation. The DPA must prohibit Meridian from retaining, using, or disclosing personal information for any purpose other than performing the services specified in the DPA, including any commercial purpose other than providing the contracted services. This provision must be drafted with sufficient specificity to foreclose Meridian's use of identifiable personal information in derivative analytics products.

Direct Business Relationship Restriction. The DPA must prohibit Meridian from retaining, using, or disclosing personal information outside of the direct business relationship between VMS and Meridian. This restriction reinforces the purpose limitation and ensures that Meridian does not treat VMS personal information as a freely available resource for its own independent business activities.

Compliance Obligation. The DPA must require Meridian to comply with applicable CCPA/CPRA obligations and to provide the same level of privacy protection as is required by the statute. This provision should include an express acknowledgment by Meridian that the data it receives from VMS constitutes "personal information" (and, in the case of GPS/geolocation data, "sensitive personal information") under the CCPA/CPRA.

Monitoring Rights. The DPA must grant VMS the right to take reasonable and appropriate steps to ensure that Meridian uses personal information in a manner consistent with VMS's CCPA/CPRA obligations. This includes audit rights, inspection rights, and the right to request information regarding Meridian's data processing practices.

Inability-to-Comply Notification. The DPA must require Meridian to notify VMS if it determines that it can no longer meet its obligations under the CCPA/CPRA. This notification must be provided promptly and must include a description of the circumstances giving rise to Meridian's inability to comply.

Remediation Rights. The DPA must grant VMS the right to stop and remediate unauthorized use of personal information upon notice from Meridian or upon VMS's own determination that unauthorized use has occurred. This includes the right to suspend data transfers, to require the return or destruction of personal information, and to terminate the arrangement if Meridian's non-compliance cannot be remedied.

2. Sensitive Personal Information Handling. As noted in Section IV.B.2 above, GPS/geolocation data constitutes "sensitive personal information" under the CPRA. Cal. Civ. Code § 1798.140(ae)(1)(A). The classification of GPS/geolocation data as sensitive personal information triggers additional obligations that must be addressed in the DPA.

Under the CPRA, consumers have the right to limit a business's use and disclosure of sensitive personal information to purposes that are "reasonably necessary and proportionate" to the purposes for which the information was collected or processed. Cal. Civ. Code § 1798.121(a). VMS must ensure that its own use and disclosure of GPS/geolocation data — including the disclosure to Meridian — is consistent with this standard. The DPA must restrict Meridian's processing of GPS/geolocation data to the specific purposes enumerated in the DPA and must prohibit Meridian from using GPS/geolocation data for any purpose beyond what is reasonably necessary and proportionate to the contracted analytics services.

We recommend that the DPA include a specific annex or schedule addressing sensitive personal information handling requirements. This annex should identify the specific categories of sensitive personal information (GPS/geolocation data) included in the data transfer, describe the permitted processing purposes, establish enhanced security measures applicable to sensitive personal information, and set forth any additional restrictions or limitations on use, retention, and disclosure.

3. Consumer Rights Facilitation. The CCPA/CPRA grants California consumers a range of rights with respect to their personal information, including the right to access, the right to deletion, the right to correction, and the right to opt out of sales or sharing. VMS, as the business that collected the personal information, bears primary responsibility for receiving and responding to consumer rights requests. However, VMS's ability to fulfill these requests depends in part on Meridian's cooperation, particularly where personal information has been transferred to Meridian and is held in Meridian's systems.

The DPA should include provisions requiring Meridian to cooperate with VMS in responding to consumer rights requests from California consumers. Specific requirements should include:

• A mechanism for VMS to forward consumer rights requests to Meridian for processing.

• Defined response timelines for Meridian to act on forwarded requests (e.g., within five (5) business days of receipt of the request from VMS).

• Operational procedures for the deletion, correction, or return of personal information held by Meridian in response to verified consumer requests.

• An obligation on Meridian to notify Cloudvault and any other sub-processors of consumer rights requests and to ensure that such sub-processors comply with applicable deletion or correction obligations.

• Recordkeeping requirements to document Meridian's handling of consumer rights requests and to facilitate VMS's own compliance reporting.

4. De-identification and Aggregation Standards. As discussed in Section IV.C.1 above, the preservation of Meridian's service provider status under the CCPA/CPRA depends on ensuring that derivative analytics products developed by Meridian do not incorporate personal information in identifiable form. The DPA should require that Meridian use only de-identified or aggregated data — not personal information — in the development and commercialization of derivative analytics products.

The CCPA/CPRA establishes specific standards for de-identification. Under Cal. Civ. Code § 1798.140(m), "de-identified" information is information that "cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer," provided that the business (or, in this case, the service provider) that possesses the information:

(a) has implemented technical safeguards that prohibit re-identification of the consumer to whom the information may pertain;

(b) has implemented business processes that specifically prohibit re-identification of the information;

(d) makes no attempt to re-identify the information.

The DPA should require Meridian to meet each of these de-identification requirements as a condition of using VMS-derived data in derivative analytics products. The DPA should also require Meridian to document its de-identification processes, to make such documentation available to VMS upon request, and to certify periodically that its de-identification processes continue to meet the CCPA/CPRA standard.

Aggregated data — defined under the CCPA/CPRA as information that relates to a group or category of consumers from which individual consumer identities have been removed and that is not linked or reasonably linkable to any consumer or household — represents an additional permissible basis for derivative product development. The DPA should define the aggregation standards applicable to Meridian's use of VMS data and should require Meridian to certify that aggregated data used in derivative products is not linked or reasonably linkable to any individual consumer.

E. Enforcement and Penalty Considerations

The CCPA/CPRA is enforced by both the California Attorney General and the California Privacy Protection Agency ("CPPA"), an independent agency established by the CPRA with rulemaking and enforcement authority. The CPPA is expected to assume primary enforcement responsibility upon completion of its rulemaking process.

Of particular significance to the VMS-Meridian arrangement is the CCPA's private right of action for data breach violations. Cal. Civ. Code § 1798.150. This provision authorizes California consumers to bring civil actions against businesses that fail to implement and maintain reasonable security procedures, where such failure results in unauthorized access, theft, or disclosure of non-encrypted or non-redacted personal information. Statutory damages range from $100 to $750 per consumer per incident, or actual damages, whichever is greater.

The potential statutory damages exposure in the context of the VMS-Meridian arrangement is substantial:

With approximately 112,000 California consumers potentially affected by a data breach involving VMS personal information held by Meridian, the maximum statutory damages exposure could reach approximately $84 million. This figure significantly exceeds Meridian's proposed $15 million aggregate liability cap in the DPA, and it does not account for additional actual damages, attorneys' fees, injunctive relief, or administrative penalties imposed by the California Attorney General or the CPPA.

This analysis strongly supports VMS's position that the DPA's liability provisions should either (a) exclude data breaches and unauthorized processing from the aggregate liability cap entirely (i.e., treat data protection liabilities as uncapped), or (b) establish a substantially higher cap for data protection-related liabilities that reflects the realistic range of statutory damages exposure. The current $15 million cap proposed by Meridian is inadequate to protect VMS's interests in light of the foregoing exposure analysis.

V. Federal Drivers' Privacy Protection Act (18 U.S.C. §§ 2721 *et seq.*)

A. Statutory Overview

The Drivers' Privacy Protection Act ("DPPA") was enacted by Congress in 1994 to restrict the disclosure of personal information obtained by state Departments of Motor Vehicles ("DMVs") in connection with motor vehicle records. The DPPA was adopted in response to growing concerns about the use and misuse of DMV-held personal information, including the sale of such information to commercial data brokers and its use in stalking and harassment.

The DPPA applies to any person who knowingly obtains, discloses, or uses personal information from a motor vehicle record for a purpose not permitted by the statute. 18 U.S.C. § 2722. The statute creates a tiered system of protections, distinguishing between "personal information" and "highly restricted personal information."

Personal Information. Under 18 U.S.C. § 2725(3), "personal information" is defined as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information." The statute does not expressly enumerate VINs as "personal information," but VINs serve as a gateway to identifying information about vehicle owners through their linkage to motor vehicle title and registration records maintained by state DMVs.

Highly Restricted Personal Information. Under 18 U.S.C. § 2725(4), "highly restricted personal information" includes an individual's photograph, Social Security number, and medical or disability information. Such information is subject to additional protections beyond those applicable to "personal information" generally.

Motor Vehicle Record. Under 18 U.S.C. § 2725(1), a "motor vehicle record" is defined as "any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles."

Permissible Uses. The DPPA enumerates fourteen permissible uses for which personal information from motor vehicle records may be disclosed. 18 U.S.C. § 2721(b). These permissible uses include, among others, use in connection with motor vehicle or driver safety (§ 2721(b)(1)), use by insurers in connection with underwriting and claims investigation (§ 2721(b)(6)), use for research activities with restrictions on individual identification (§ 2721(b)(5)), and use for any purpose specifically authorized by the individual (§ 2721(b)(13)).

B. Applicability to the VMS-Meridian Arrangement

1. Does VMS Data Derive from Motor Vehicle Records?. The threshold applicability question under the DPPA is whether the personal information that VMS proposes to share with Meridian was "obtained" from a "motor vehicle record" within the meaning of the statute. This question requires careful examination of the data provenance of VMS's owner/lessee identification information.

Direct Data Collection. VMS collects vehicle telemetry and in-cabin sensor data directly from vehicles via the VantageLink system. This data is generated by vehicle sensors — GPS receivers, accelerometers, pressure sensors, occupancy sensors, and the like — and is transmitted to VMS's cloud infrastructure in real time. The vehicle-generated data itself is not obtained from state DMV records; it is created independently by the vehicle's onboard systems. Standing alone, this data stream does not implicate the DPPA.

VIN Linkage. However, the vehicle-generated data is linked to VINs, and VINs are linked to vehicle registration information that originates from state DMV records. The VIN is encoded in the vehicle's hardware and is transmitted as part of the telemetry data stream. The linkage between a VIN and the identity of a vehicle's registered owner or lessee is established through motor vehicle title and registration records maintained by state DMVs.

Connected Insights Opt-In Process. VMS's Connected Insights opt-in process requires vehicle owner/lessee identity verification. The method by which VMS verifies owner/lessee identity is a critical factual question for DPPA purposes. If VMS verifies owner/lessee identity through its own independent consumer registration process — for example, by collecting identity information directly from the consumer through a VantageLink account registration form — then the personal information associated with the owner/lessee may not be "obtained" from a motor vehicle record. In contrast, if VMS's data systems incorporate or cross-reference DMV-sourced registration data — including automated VIN-to-owner lookups using databases derived from state title or registration records — then at least a subset of the personal information in VMS's systems may fall within the DPPA's scope.

Analysis. The DPPA's applicability to the VMS-Meridian arrangement turns on this data provenance question, which we cannot resolve definitively on the basis of information currently available. We understand that VMS's Connected Services team, led by Marcus Chen (Vice President, Connected Services), manages the data ingestion and identity verification processes for the Connected Insights program, and that Diana Kowalski (Chief Privacy Officer) has oversight of the data governance implications. We recommend that VMS confirm with Mr. Chen and Ms. Kowalski the precise data provenance of owner/lessee identification information linked to VINs — specifically, whether VMS's systems incorporate, cross-reference, or derive any owner/lessee identity data from state DMV title or registration databases, or whether all such data is independently collected through VMS's own consumer-facing registration process.

If the investigation reveals that VMS does incorporate DMV-sourced data, even indirectly (e.g., through a third-party data vendor that aggregates registration data from state DMVs), the DPPA would apply to the subset of personal information derived from such records.

2. Permissible Use Analysis. If the DPPA is determined to apply to any portion of the VMS data shared with Meridian, VMS's disclosure of VIN-linked personal information to Meridian must fall within one or more of the permissible uses enumerated in 18 U.S.C. § 2721(b). Three permissible uses are potentially applicable:

§ 2721(b)(1): Motor Vehicle or Driver Safety. This permissible use authorizes the disclosure of personal information for use "in connection with matters of motor vehicle or driver safety." If the analytics services provided by Meridian are framed as contributing to motor vehicle or driver safety — for example, through the development of safety-related insights, crash prevention algorithms, or driving behavior risk models — this permissible use may be available. However, the breadth of Meridian's proposed analytics activities, which extend beyond safety-related applications to general commercial analytics and derivative product development, may make it difficult to rely exclusively on this permissible use for all data transfers.

§ 2721(b)(12): Bulk Distribution with Consent. This permissible use authorizes the disclosure of personal information for bulk distribution for surveys, marketing, or solicitations, if the state has obtained the express consent of the person to whom such personal information pertains. This provision may be applicable in states where the vehicle owner/lessee has provided express consent through the Connected Insights opt-in process and where the relevant state has a mechanism for recording and communicating such consent to DMV data recipients. The practical applicability of this provision depends on the specific consent mechanisms in place in each state, which vary significantly.

§ 2721(b)(13): Individual Authorization. This permissible use authorizes the disclosure of personal information for "any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety." Additionally, the DPPA permits disclosure where the individual to whom the information pertains has provided express consent. The Connected Insights opt-in consent obtained from vehicle owners and lessees may satisfy this individual authorization provision, provided that the consent language expressly covers the disclosure of personal information to third-party data processors such as Meridian for analytics purposes.

Recommendation. VMS should review the Connected Insights opt-in consent forms to assess whether the consent language is sufficiently broad to cover disclosure to Meridian and to satisfy the individual authorization requirements of the DPPA. If the existing consent language is deficient, VMS should consider updating its consent forms to include an express authorization for disclosure to third-party analytics providers and data processors.

3. DPPA Penalties. The DPPA provides for both criminal and civil penalties for violations.

Criminal Penalties. Under 18 U.S.C. § 2723, a person who knowingly obtains, discloses, or uses personal information from a motor vehicle record for a purpose not permitted by the statute is subject to a criminal fine. If the violation is committed with the intent to make a profit, the court may impose a fine of up to $5,000 per day for each day that the violation continues.

Civil Penalties. Under 18 U.S.C. § 2724, a person who knowingly obtains, discloses, or uses personal information from a motor vehicle record in a manner not authorized by the statute is liable to the individual to whom the information pertains. The individual may recover actual damages (but not less than liquidated damages of $2,500 per violation), punitive damages upon proof of willful or reckless disregard for the law, reasonable attorneys' fees, and other preliminary and equitable relief as the court may determine to be appropriate.

The DPPA's penalty provisions reinfor

MEMORANDUM
PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT
Date: October 18, 2022
To:
Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP
Diana Kowalski, Chief Privacy Officer, Vantage Mobility Systems Corp.
Thomas Langford, General Counsel, Vantage Mobility Systems Corp.
From:
Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP
Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP
Re: Regulatory Applicability Analysis — VMS-Meridian Data-Sharing Arrangement (Michigan Identity Theft Protection Act, CCPA/CPRA, DPPA)
Matter No.: 1007-00007
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to analyze the applicability of three key privacy and data protection statutes to the proposed data-sharing arrangement between Vantage Mobility Systems Corp. ("VMS") and Meridian Telematics Solutions, Inc. ("Meridian"), under which Meridian would receive and process connected-vehicle telemetry and in-cabin sensor data generated by VMS's VantageLink platform. This analysis is intended to inform the negotiation of the Data Processing Agreement ("DPA") currently under discussion between the parties and to identify regulatory risks that should be addressed through specific contractual provisions.
The three statutes analyzed herein are: (1) the Michigan Identity Theft Protection Act ("Michigan ITPA"), MCL §§ 445.61 et seq.; (2) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), Cal. Civ. Code §§ 1798.100 et seq.; and (3) the federal Drivers' Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721 et seq. Each statute implicates a distinct set of compliance obligations, and the interplay among them creates a layered regulatory framework that the DPA must accommodate.
Our principal conclusions are as follows:
Michigan ITPA. The Michigan ITPA is applicable to the proposed arrangement to the extent that VMS transfers personal identifying information — including vehicle identification number ("VIN")-linked geolocation data and VIN-linked seat occupancy data — to Meridian. The statute imposes security breach notification requirements and an obligation to implement and maintain reasonable security measures. Although the Michigan ITPA does not establish a formal "data processor" regime comparable to that found in the CCPA/CPRA, VMS's obligations as the data owner extend to ensuring that third-party processors receiving personal identifying information maintain adequate security. The DPA must contractually impose Michigan ITPA-compliant security and breach notification obligations on Meridian.
CCPA/CPRA. The CCPA/CPRA is applicable to the proposed arrangement. VMS qualifies as a "business" under the statute based on its annual revenue, its operations in California, and the volume of California consumer data it processes. An estimated 112,000 California-registered vehicles are among the approximately 800,000 vehicles whose owners and lessees have opted into VMS's Connected Insights data-sharing program, representing approximately 14% of the relevant data subject population. VIN-linked GPS and geolocation data, seat occupancy data, and the remaining twelve categories of vehicle telemetry data — when transmitted with or linkable to VINs — likely constitute "personal information" under the CCPA/CPRA. GPS/geolocation data additionally qualifies as "sensitive personal information" under the CPRA. The DPA must include the full suite of service provider contractual provisions mandated by Cal. Civ. Code § 1798.100(d), and the arrangement must be carefully structured to preserve Meridian's classification as a "service provider" rather than a "third party" — particularly with respect to Meridian's development of derivative analytics products.
DPPA. The DPPA is potentially applicable to the proposed arrangement to the extent that VMS data includes motor vehicle records or personal information derived from state Department of Motor Vehicles ("DMV") records linked to vehicle owners and lessees through VINs. The DPPA's applicability turns on the data provenance of VMS's owner/lessee identification information — specifically, whether VMS "obtained" such information from motor vehicle records or independently collected it through its own consumer registration process. The scope of the DPPA may limit its direct applicability, but the potential for overlap warrants the inclusion of protective DPA provisions addressing DPPA compliance. An alternative structural approach — de-linking VIN data from personal information derived from motor vehicle records before transferring data to Meridian — should be evaluated for technical feasibility.
Key Recommendation. The DPA should include statute-specific compliance provisions addressing all three regulatory frameworks. The specific recommendations are set forth in detail in Section VI of this memorandum and encompass breach notification timelines, service provider contractual terms, data de-identification and aggregation standards, consumer rights facilitation obligations, audit rights, sub-processor flow-down requirements, liability and indemnification provisions, and data retention limitations.
II. Background and Factual Context
A. The Parties
Vantage Mobility Systems Corp. VMS is a Delaware corporation headquartered at 4700 Automation Boulevard, Suite 300, Auburn Hills, Michigan 48326. VMS designs, manufactures, and sells connected-vehicle hardware modules and integrated mobility platforms to automotive original equipment manufacturers ("OEMs") and aftermarket distributors. VMS's flagship product is the VantageLink system, a connected-vehicle telematics module that enables real-time data collection, remote diagnostics, and over-the-air software updates. VMS is a portfolio company of Northgate Capital Partners LLC, which holds a 72% controlling equity stake acquired in November 2019 through Northgate Fund II, L.P. VMS's fiscal year 2021 revenue was approximately $385 million. VMS employs approximately 1,200 individuals across its operations.
VMS's Connected Insights program, the vehicle-data-sharing program relevant to this analysis, allows owners and lessees of VantageLink-equipped vehicles to voluntarily opt into the sharing of vehicle telemetry and in-cabin sensor data. As of the date of this memorandum, approximately 800,000 of the 2.4 million vehicles in VMS's total connected-vehicle install base have opted into the Connected Insights program.
Meridian Telematics Solutions, Inc. Meridian is a Delaware corporation headquartered at 1250 Embarcadero Way, Suite 400, Palo Alto, California 94303, with a data operations center located at 8900 Research Park Drive, Building C, Austin, Texas 78759. Meridian provides cloud-based analytics and machine-learning services to automotive OEMs and Tier 1 suppliers. Meridian employs approximately 340 individuals and reported annual recurring revenue ("ARR") of approximately $78 million as of the second quarter of 2022. Meridian's leadership team includes Priya Ramanathan (Chief Executive Officer), Julian Voss (Chief Technology Officer), and Lena Torrance (Head of Data Governance).
B. The Proposed Data-Sharing Arrangement
On August 5, 2022, VMS and Meridian executed a non-binding letter of intent ("LOI") outlining the principal terms of a data-sharing and analytics arrangement. Under the proposed arrangement, Meridian would receive and process fourteen (14) categories of vehicle telemetry and in-cabin sensor data from VMS's VantageLink platform. The fourteen data categories are as follows:
1.  GPS/geolocation
2.  Vehicle speed
3.  Acceleration/deceleration
4.  Braking events
5.  Tire pressure
6.  Engine diagnostic codes
7.  Fuel consumption
8.  In-cabin temperature
9.  In-cabin humidity
10.  Seat occupancy
11.  Seatbelt status
12.  Ambient noise levels
13.  Windshield wiper activation
14.  Headlight/taillight status
The data would be collected from approximately 800,000 active VantageLink-equipped vehicles whose owners and lessees have opted into VMS's Connected Insights data-sharing program. The estimated data volume to be transmitted to Meridian is approximately 4.2 terabytes per day.
The principal commercial terms outlined in the LOI are as follows: Meridian would pay VMS an annual license fee of $6.5 million, payable in quarterly installments of $1,625,000 per quarter. Meridian would additionally pay VMS a 3.5% royalty on net revenue from derivative analytics products sold by Meridian to third parties that incorporate VMS-sourced data. The base term of the arrangement is three (3) years, with two (2) optional one-year renewal periods. The total base-term contract value is $19.5 million.
C. VMS Internal Data Governance Classifications
VMS's internal data governance policy establishes a tiered classification system for vehicle-generated data. Under this system, GPS/geolocation data and seat occupancy data are classified as "Sensitive Vehicle Data" when combined with vehicle identification numbers ("VINs"), because the combination of these data elements with a VIN enables linkage to identifiable individuals — specifically, the registered owner or lessee of the vehicle in question. VMS's data governance policy recognizes that VINs serve as a persistent identifier that, through cross-referencing with state motor vehicle registration databases and VMS's own customer records, permits the identification of a specific individual and the attribution of behavioral and locational data to that individual.
The remaining twelve (12) data categories — vehicle speed, acceleration/deceleration, braking events, tire pressure, engine diagnostic codes, fuel consumption, in-cabin temperature, in-cabin humidity, seatbelt status, ambient noise levels, windshield wiper activation, and headlight/taillight status — are classified as non-sensitive vehicle telemetry when not combined with identifying information such as VINs. However, when transmitted alongside VINs or in combination with Sensitive Vehicle Data, these categories may take on an identifying character, a point that is addressed in detail in the statutory analyses below.
D. Sub-Processing Arrangements
Meridian has proposed utilizing Cloudvault Infrastructure, Inc. ("Cloudvault") as a sub-processor for purposes of hosting and processing VMS data. Cloudvault is a Nevada corporation headquartered in Reno, Nevada, and operates data centers in Reno, Nevada and Columbus, Ohio (7400 Crossroads Boulevard, Columbus, Ohio 43219). Meridian and Cloudvault are parties to an existing master services agreement executed on March 1, 2021. Under the proposed arrangement, Cloudvault's "AutoCloud" platform would host and process VMS data within Cloudvault's domestic data centers.
Meridian has disclosed the possibility of a future migration of certain data processing operations to Cloudvault's Dublin, Ireland facility (Unit 12, Parkwest Business Campus, Dublin 12, Ireland). The cross-border data transfer implications of such a migration — including any applicability of the EU General Data Protection Regulation ("GDPR") and related international transfer mechanisms — are addressed in a separate memorandum and are outside the scope of this analysis.
E. Geographic Distribution of Data Subjects
Of the approximately 800,000 vehicles whose owners and lessees have opted into the Connected Insights program, approximately 112,000 are registered in the State of California. This represents approximately 14% of the total data subject population. This concentration of California-registered vehicles is a primary driver of the CCPA/CPRA analysis set forth in Section IV of this memorandum, as it establishes a substantial California consumer population whose personal information would be shared with Meridian under the proposed arrangement.
The remaining vehicles in the Connected Insights program are distributed across other U.S. states and Canadian provinces. No European Union data subjects are currently within the scope of the proposed data-sharing arrangement, although the potential Cloudvault Dublin migration discussed above could alter this assessment.
F. Governing Law
The parties have agreed that the DPA will be governed by and construed in accordance with the laws of the State of Michigan. The implications of this governing law selection for CCPA/CPRA compliance are discussed in Section VI.D below.
III. Michigan Identity Theft Protection Act (MCL §§ 445.61 *et seq.*)
A. Statutory Overview
The Michigan Identity Theft Protection Act was enacted to protect Michigan residents from identity theft and to establish a framework for the responsible handling of personal identifying information by persons and agencies that own, license, or maintain such information. The statute's key operative provisions are found in MCL §§ 445.63 through 445.77 and include the following principal requirements:
Security Breach Notification. MCL § 445.72 requires that a person or agency that owns or licenses data that includes personal identifying information of a Michigan resident must provide notice of a security breach to each Michigan resident whose personal identifying information was subject to unauthorized access and acquisition. The notice must be provided "without unreasonable delay." The statute permits reasonable delay in order to allow the person or agency to determine the scope of the breach and restore the integrity of the data system, but does not specify a fixed hour-count or day-count notification deadline.
Security Measures. The Michigan ITPA imposes a duty on persons and agencies that own or license data containing personal identifying information to implement and maintain reasonable security measures to protect that information from unauthorized access, acquisition, destruction, use, modification, or disclosure. The statute does not prescribe specific technical standards, leaving the determination of "reasonableness" to be assessed in light of the circumstances, including the sensitivity of the data, the size and complexity of the entity, and the cost of available security measures.
Definition of Personal Identifying Information. The statute defines "personal identifying information" to include, among other things, an individual's name, Social Security number, driver's license number, state personal identification card number, and other enumerated identifiers. MCL § 445.63. The statute's enumerated list is not expressly limited to the categories listed, and the overall protective purpose of the statute supports a reading that encompasses data combinations that enable the identification of specific individuals.
Scope. The Michigan ITPA applies to any "person" or "agency" that owns or licenses data that includes personal identifying information of a Michigan resident. The term "person" is defined broadly and includes corporations, partnerships, associations, and other legal entities. The statute does not contain an express jurisdictional limitation tied to the location of the person or agency; rather, the nexus is to the residency of the individuals whose personal identifying information is at issue.
B. Applicability to the VMS-Meridian Arrangement
1. Does VMS Data Constitute "Personal Identifying Information" Under the Michigan ITPA?.  The threshold question is whether the data that VMS proposes to transfer to Meridian constitutes "personal identifying information" within the meaning of the Michigan ITPA. We address this question with respect to the specific data categories at issue.
VINs Alone. Vehicle identification numbers are not explicitly enumerated in the Michigan ITPA's definition of personal identifying information. A VIN is a unique 17-character alphanumeric code assigned to a motor vehicle at the time of manufacture and does not, standing alone, identify a natural person. However, VINs can be cross-referenced with state motor vehicle registration databases — including the Michigan Secretary of State's records — to identify the registered owner or lessee of a vehicle. This cross-referencing capability transforms a VIN from a vehicle identifier into a link to an identifiable individual. While the Michigan ITPA's definition of personal identifying information is framed in terms of enumerated identifiers associated with a specific individual, the combination of a VIN with additional data elements (as discussed below) effectively creates a data set that functions as personal identifying information.
VIN-Linked GPS/Geolocation Data. When GPS/geolocation data is combined with VIN data, the resulting data set reveals the real-time and historical location and movement patterns of an identifiable individual — namely, the registered owner or lessee of the vehicle associated with the VIN. This combination arguably constitutes personal identifying information under the Michigan ITPA because it can be used, in conjunction with publicly available motor vehicle registration records, to identify a specific individual and to reveal sensitive details about that individual's daily activities, residential location, places of employment, and associations. Michigan courts have not directly addressed whether VIN-linked geolocation data constitutes personal identifying information under the Michigan ITPA, but the statute's protective purpose and its broad definitional framework support this interpretation.
VIN-Linked Seat Occupancy Data. Seat occupancy data reveals whether a vehicle is occupied and the number of occupants at any given time. When combined with VIN data and geolocation data, seat occupancy data may enable inferences about an identifiable individual's daily patterns, household composition, cohabitants, and personal habits. For example, the combination of VIN-linked geolocation data showing a vehicle at a residential address during nighttime hours, combined with seat occupancy data indicating two occupants, could reveal information about an individual's domestic arrangements. This type of inferential profiling capability strengthens the argument that VIN-linked seat occupancy data, in combination with other data elements, constitutes personal identifying information within the statute's protective scope.
Analysis. VMS's own internal data governance classification system recognizes that GPS/geolocation data and seat occupancy data become "Sensitive Vehicle Data" when combined with VINs. This internal classification aligns with the Michigan ITPA's protective scope. The transfer of VIN-linked data sets to Meridian — encompassing geolocation data, seat occupancy data, and potentially other telemetry data that acquires an identifying character through VIN linkage — brings these data elements within the reach of the Michigan ITPA's security and breach notification requirements. We conclude that the Michigan ITPA applies to the extent VMS transfers VIN-linked geolocation data and VIN-linked seat occupancy data to Meridian, and may apply more broadly to other VIN-linked data categories depending on the identifiability analysis applicable in each case.
2. VMS's Obligations as Data Owner/Licensor.  VMS, as the entity that owns and licenses the connected-vehicle data generated by the VantageLink platform, bears primary obligations under the Michigan ITPA. These obligations include:
Security Measures. VMS is required to implement and maintain reasonable security measures to protect personal identifying information from unauthorized access, acquisition, destruction, use, modification, or disclosure. This obligation extends to the manner in which VMS stores, transmits, and shares personal identifying information — including the transfer of such information to Meridian under the proposed arrangement. VMS must ensure that the security protections governing the data transfer are commensurate with the sensitivity of the data and the risk of unauthorized access.
Breach Notification. In the event of a security breach affecting personal identifying information of Michigan residents, VMS is obligated to provide notice to each affected Michigan resident "without unreasonable delay." MCL § 445.72(1). The statute permits a reasonable delay to allow VMS to determine the scope of the security breach and to restore the reasonable integrity of the data system, but the notification must be provided promptly once these preliminary assessments are completed. Notably, the statute does not prescribe a specific hour-count for breach notification. This contrasts with VMS's proposed 24-hour contractual notification standard and Meridian's proposed 72-hour notification standard. The contractual timeline adopted in the DPA should be set at a level that allows VMS to receive timely notice from Meridian and, in turn, satisfy its own statutory obligation to notify affected Michigan residents "without unreasonable delay."
Third-Party Processor Oversight. While the Michigan ITPA does not establish a formal "data processor" or "service provider" regime comparable to the frameworks established by the CCPA/CPRA or the GDPR, VMS's obligations as the data owner extend to ensuring that third parties processing personal identifying information on its behalf maintain adequate security. A failure by Meridian to protect VMS data could expose VMS to liability under the statute, as VMS remains the party that "owns or licenses" the data in question.
3. Flow-Down Requirements to Meridian as Data Processor.  As noted above, the Michigan ITPA does not contain an express statutory requirement for contractual flow-down provisions governing the relationship between a data owner and a third-party processor. The statute places the burden of compliance on the entity that owns or licenses the data, without prescribing specific contractual mechanisms for managing downstream processing relationships. However, the practical effect of this framework is that VMS must take affirmative steps to ensure that Meridian's processing activities do not compromise VMS's ability to meet its statutory obligations.
We recommend that the DPA serve as the contractual mechanism for imposing Michigan ITPA-compliant obligations on Meridian. Specifically, the DPA should require Meridian to implement and maintain reasonable security measures consistent with the Michigan ITPA's standards, to promptly notify VMS of any actual or suspected security breach affecting Michigan residents' personal identifying information, and to cooperate with VMS in investigating and remediating any such breach. The DPA should also require Meridian to flow down these obligations to any sub-processors, including Cloudvault.
C. Recommended DPA Provisions — Michigan ITPA Compliance
Based on the foregoing analysis, we recommend that the DPA include the following provisions addressing Michigan ITPA compliance:
1.  Reasonable Security Measures. A contractual requirement for Meridian to implement and maintain reasonable security measures — consistent with the standards applicable under the Michigan ITPA — to protect VMS personal identifying information from unauthorized access, acquisition, destruction, use, modification, or disclosure. The DPA should specify minimum security requirements, including encryption standards, access controls, employee training, and incident response procedures, with reference to recognized industry frameworks (e.g., NIST Cybersecurity Framework, ISO/IEC 27001).
2.  Breach Notification. A breach notification provision requiring Meridian to notify VMS of any actual or reasonably suspected security breach affecting personal identifying information of Michigan residents within a timeframe sufficient for VMS to meet its "without unreasonable delay" statutory obligation. This provision supports VMS's proposed 24-hour notification window in the DPA. Meridian's proposed 72-hour notification window introduces unacceptable risk that VMS may be unable to comply with its statutory obligations in a timely manner.
3.  Indemnification. An indemnification provision requiring Meridian to indemnify, defend, and hold harmless VMS from and against any costs, damages, penalties, fines, and expenses (including reasonable attorneys' fees) arising from Meridian's failure to comply with Michigan ITPA requirements or with the Michigan ITPA-related provisions of the DPA.
4.  Representations and Warranties. Representations from Meridian regarding its understanding of and compliance with applicable Michigan data protection law, including the Michigan ITPA, and an acknowledgment that Meridian will process VMS data in a manner consistent with VMS's obligations under the statute.
IV. California Consumer Privacy Act / California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 *et seq.*)
A. Statutory Overview
The California Consumer Privacy Act ("CCPA"), which took effect on January 1, 2020, and its successor amendments enacted through the California Privacy Rights Act ("CPRA"), which take effect on January 1, 2023 (with a look-back period to January 1, 2022), together establish the most comprehensive state-level consumer privacy framework in the United States. The CCPA/CPRA grants California residents (referred to as "consumers") a suite of substantive privacy rights and imposes corresponding obligations on for-profit businesses that collect, process, or share consumers' personal information.
The key consumer rights established by the CCPA/CPRA include: (1) the right to know what personal information a business collects and how it is used and shared; (2) the right to delete personal information held by a business and its service providers; (3) the right to opt out of the "sale" or "sharing" of personal information; (4) the right to correct inaccurate personal information (added by the CPRA); and (5) the right to limit the use and disclosure of "sensitive personal information" (added by the CPRA).
The CCPA/CPRA applies to for-profit entities doing business in California that meet one or more of the following thresholds: (a) annual gross revenue in excess of $25 million in the preceding calendar year; (b) annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or (c) deriving 50% or more of annual revenue from selling or sharing consumers' personal information.
The statute imposes specific contractual requirements on businesses that disclose personal information to "service providers" and "contractors" — entities that process personal information on behalf of a business pursuant to a written contract containing specified restrictive terms. The distinction between a "service provider" (or "contractor") and a "third party" is of critical importance: a transfer of personal information to a service provider or contractor is not a "sale" or "sharing" under the statute, whereas a transfer to a third party may constitute a "sale" or "sharing," triggering the consumer's right to opt out and other heightened compliance obligations.
B. Threshold Applicability Analysis
1. Does VMS Qualify as a "Business" Under CCPA/CPRA?.  The CCPA/CPRA applies to "businesses," which are defined as for-profit legal entities that do business in the State of California and that satisfy one or more of the statute's threshold requirements. Cal. Civ. Code § 1798.140(d). We analyze each element below.
For-Profit Entity. VMS is a for-profit Delaware corporation. This element is satisfied.
Does Business in California. VMS operates in California in multiple respects: VantageLink-equipped vehicles are operated by consumers in California; VMS collects vehicle telemetry and in-cabin sensor data from California-based vehicles; and VMS has a commercial relationship with Meridian, a California-headquartered entity. VMS's operations in California are sufficient to establish that it "does business" in the state within the meaning of the statute.
Revenue Threshold. VMS's fiscal year 2021 revenue of approximately $385 million substantially exceeds the $25 million annual gross revenue threshold set forth in Cal. Civ. Code § 1798.140(d)(1)(A). This threshold is independently satisfied.
Consumer/Household Threshold. VMS collects personal information from approximately 112,000 California-registered vehicle owners and lessees through the Connected Insights program. This exceeds the 100,000 consumer/household threshold set forth in Cal. Civ. Code § 1798.140(d)(1)(B). This threshold is also independently satisfied.
Conclusion. VMS clearly qualifies as a "business" under the CCPA/CPRA. Both the revenue threshold and the consumer/household threshold are independently satisfied, and VMS conducts business in California. VMS is therefore subject to the full range of CCPA/CPRA obligations with respect to its collection, use, and disclosure of personal information relating to California consumers.
2. Does the VMS Data Constitute "Personal Information" Under CCPA/CPRA?.  The CCPA/CPRA defines "personal information" in expansive terms as "information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(v). This definition encompasses not only traditional identifiers (name, address, Social Security number) but also data elements that can be linked to a consumer through intermediary identifiers, unique device or vehicle identifiers, and inferences drawn from other data points.
We analyze each relevant data category below.
VIN-Linked GPS/Geolocation Data. VINs are linked to specific vehicle owners and lessees through DMV registration records and VMS's own customer account information. GPS/geolocation data that is linked to a VIN identifies the precise physical location of an identifiable consumer — specifically, the registered owner or lessee of the vehicle — at a specific point in time. This data clearly constitutes "personal information" under the CCPA/CPRA because it "identifies, relates to, [and] is reasonably capable of being associated with" a particular consumer through the VIN linkage.
Furthermore, precise geolocation data is classified as "sensitive personal information" under the CPRA. Cal. Civ. Code § 1798.140(ae)(1)(A). Sensitive personal information is subject to additional restrictions under the CPRA, including the consumer's right to limit the use and disclosure of such information to purposes that are "reasonably necessary and proportionate" to the purposes for which the information was collected or processed. Cal. Civ. Code § 1798.121(a). This classification has significant implications for the permissible scope of Meridian's processing activities, as discussed further below.
VIN-Linked Seat Occupancy Data. Seat occupancy data, when linked to a VIN, may reveal information about household composition, passenger patterns, and daily routines of an identifiable consumer. This data can be "reasonably linked" to an identified consumer through the VIN and therefore constitutes personal information under the CCPA/CPRA. While seat occupancy data does not fall within the CPRA's enumerated categories of sensitive personal information, it remains subject to the statute's general protections for personal information.
Other Data Categories. The remaining twelve data categories — vehicle speed, acceleration/deceleration, braking events, tire pressure, engine diagnostic codes, fuel consumption, in-cabin temperature, in-cabin humidity, seatbelt status, ambient noise levels, windshield wiper activation, and headlight/taillight status — when transmitted alongside VINs or in conjunction with other identifying data elements, constitute personal information under the CCPA/CPRA. Each of these categories is "reasonably capable of being associated with" a particular consumer through the VIN linkage. Vehicle speed and braking event data, for example, reveal an identifiable consumer's driving behavior; engine diagnostic codes may reveal information about the consumer's vehicle maintenance patterns; and in-cabin temperature and humidity data may reflect environmental conditions chosen by or experienced by an identifiable consumer.
Analysis of All 14 Data Categories. All fourteen data categories identified in the LOI, when transmitted with or linkable to VINs, likely constitute personal information under the CCPA/CPRA. The breadth of the statute's definition — which encompasses information that "could reasonably be linked, directly or indirectly" to a consumer — captures the full range of VIN-linked telemetry and sensor data that VMS proposes to share with Meridian. GPS/geolocation data additionally qualifies as "sensitive personal information" under the CPRA, triggering enhanced protections and use limitations.
3. Significance of 112,000 California-Registered Vehicles.  Approximately 112,000 of the 800,000 opted-in vehicles — representing approximately 14% of the total data subject population — are registered in California. This represents a substantial population of California consumers whose personal information would be shared with Meridian under the proposed arrangement.
It is important to note that the CCPA/CPRA does not impose a minimum California-consumer threshold as a condition for the statute's protections to apply to specific processing activities. The thresholds set forth in Cal. Civ. Code § 1798.140(d) are entity-level thresholds that determine whether a business is subject to the statute as a whole; once those thresholds are met, the statute's protections extend to all California consumer personal information processed by the business, regardless of the proportion of California consumers relative to the total consumer population. Accordingly, VMS's CCPA/CPRA obligations extend to all 112,000 California consumers whose data is included in the proposed data transfer, and the DPA must be structured to ensure compliance with respect to this entire population.
C. Meridian's Role Under CCPA/CPRA
1. Service Provider vs. Third Party vs. Contractor Classification.  The classification of Meridian under the CCPA/CPRA — as a "service provider," a "contractor," or a "third party" — is a threshold question with far-reaching consequences for the structuring of the proposed arrangement and the DPA.
Service Provider Status. Under Cal. Civ. Code § 1798.140(ag), a "service provider" is a legal entity that processes personal information on behalf of a business and to which the business discloses a consumer's personal information for a business purpose, pursuant to a written contract that meets specific statutory requirements. The written contract must prohibit the service provider from: (a) selling or sharing the personal information; (b) retaining, using, or disclosing the personal information for any purpose other than performing the services specified in the contract, including any commercial purpose other than providing the services specified in the contract; and (c) retaining, using, or disclosing the personal information outside of the direct business relationship between the service provider and the business. The contract must also require the service provider to comply with applicable provisions of the CCPA/CPRA, to provide the same level of privacy protection as is required by the statute, and to grant the business the right to take reasonable and appropriate steps to ensure that the service provider's use of personal information is consistent with the business's CCPA/CPRA obligations.
Risk of Third-Party Classification. Under the proposed arrangement, Meridian would process VMS data to provide analytics services to VMS — a use that is consistent with service provider status. However, Meridian also intends to develop derivative analytics products for sale to third parties, subject to the 3.5% royalty described in the LOI. This secondary commercial use creates a significant risk that Meridian may be disqualified from "service provider" status under the CCPA/CPRA. If Meridian's derivative analytics products incorporate California consumers' personal information in identifiable form — i.e., if the derivative products retain VIN linkage or other identifying characteristics that permit the data to be "reasonably linked" to a consumer — Meridian's use of the data would extend beyond the scope of the services performed on VMS's behalf and would constitute a use for Meridian's own independent commercial purposes.
If Meridian is classified as a "third party" rather than a service provider, VMS's transfer of personal information to Meridian could constitute a "sale" or "sharing" of personal information under the CCPA/CPRA. Cal. Civ. Code § 1798.140(ad) (defining "sale" as disclosing personal information for monetary or other valuable consideration); Cal. Civ. Code § 1798.140(ah) (defining "sharing" as disclosing personal information for cross-context behavioral advertising). If the transfer constitutes a "sale" or "sharing," VMS would be required to provide California consumers with the right to opt out of such sale or sharing, prominently post a "Do Not Sell or Share My Personal Information" link on its website, and honor opt-out requests — obligations that would significantly complicate the operational and commercial structure of the arrangement.
Contractor Status Under CPRA. The CPRA introduces the additional classification of "contractor," which is similar to the service provider classification and carries substantially the same contractual requirements. Cal. Civ. Code § 1798.140(j). The contractor classification is available for entities to which a business makes available a consumer's personal information for a business purpose, pursuant to a written contract that includes the same restrictive terms required for service providers. If the DPA is executed after the CPRA's effective date (January 1, 2023), the contractor classification should be considered as an alternative or complement to the service provider classification.
Recommendation. The DPA must carefully delineate the scope of Meridian's permitted uses of VMS personal information and must contain all CCPA/CPRA-mandated service provider contractual provisions as set forth in Cal. Civ. Code § 1798.100(d). To preserve Meridian's service provider status and to avoid the risk that the data transfer will be classified as a "sale" or "sharing," derivative analytics product development must be structured to use only de-identified or aggregated data — not personal information in identifiable form. The DPA should include express prohibitions on the use of personal information (i.e., VIN-linked data) in any derivative product and should require Meridian to certify that its de-identification processes meet the CCPA/CPRA's statutory standard.
2. Sub-Processor Flow-Down (Cloudvault).  The CCPA/CPRA requires service providers to notify the business of any sub-processor engagements and to ensure that sub-processors are contractually bound to the same restrictions that apply to the service provider. Cal. Civ. Code § 1798.140(ag)(2). Meridian's proposed use of Cloudvault as a sub-processor for hosting and processing VMS data on the AutoCloud platform triggers this requirement.
The DPA must include flow-down obligations requiring Meridian to: (a) notify VMS of its engagement of Cloudvault (and any other sub-processor) prior to the commencement of processing; (b) contractually bind Cloudvault to CCPA/CPRA-compliant terms that are no less restrictive than the terms imposed on Meridian in the DPA; and (c) remain liable to VMS for the acts and omissions of Cloudvault with respect to the processing of VMS personal information. VMS should also retain the right to object to the engagement of any sub-processor and to require Meridian to terminate sub-processing arrangements that do not meet VMS's compliance standards.
D. Specific CCPA/CPRA Compliance Obligations for the DPA
1. Contractual Provisions Required by Cal. Civ. Code § 1798.100(d).  The CCPA/CPRA mandates that the written contract between a business and a service provider or contractor include specific provisions. The DPA must contain each of the following:
Prohibition on Selling or Sharing. The DPA must prohibit Meridian from selling or sharing personal information received from VMS. This prohibition must be absolute and unqualified, extending to all personal information received, derived, or generated from the VMS data transfer.
Purpose Limitation. The DPA must prohibit Meridian from retaining, using, or disclosing personal information for any purpose other than performing the services specified in the DPA, including any commercial purpose other than providing the contracted services. This provision must be drafted with sufficient specificity to foreclose Meridian's use of identifiable personal information in derivative analytics products.
Direct Business Relationship Restriction. The DPA must prohibit Meridian from retaining, using, or disclosing personal information outside of the direct business relationship between VMS and Meridian. This restriction reinforces the purpose limitation and ensures that Meridian does not treat VMS personal information as a freely available resource for its own independent business activities.
Compliance Obligation. The DPA must require Meridian to comply with applicable CCPA/CPRA obligations and to provide the same level of privacy protection as is required by the statute. This provision should include an express acknowledgment by Meridian that the data it receives from VMS constitutes "personal information" (and, in the case of GPS/geolocation data, "sensitive personal information") under the CCPA/CPRA.
Monitoring Rights. The DPA must grant VMS the right to take reasonable and appropriate steps to ensure that Meridian uses personal information in a manner consistent with VMS's CCPA/CPRA obligations. This includes audit rights, inspection rights, and the right to request information regarding Meridian's data processing practices.
Inability-to-Comply Notification. The DPA must require Meridian to notify VMS if it determines that it can no longer meet its obligations under the CCPA/CPRA. This notification must be provided promptly and must include a description of the circumstances giving rise to Meridian's inability to comply.
Remediation Rights. The DPA must grant VMS the right to stop and remediate unauthorized use of personal information upon notice from Meridian or upon VMS's own determination that unauthorized use has occurred. This includes the right to suspend data transfers, to require the return or destruction of personal information, and to terminate the arrangement if Meridian's non-compliance cannot be remedied.
2. Sensitive Personal Information Handling.  As noted in Section IV.B.2 above, GPS/geolocation data constitutes "sensitive personal information" under the CPRA. Cal. Civ. Code § 1798.140(ae)(1)(A). The classification of GPS/geolocation data as sensitive personal information triggers additional obligations that must be addressed in the DPA.
Under the CPRA, consumers have the right to limit a business's use and disclosure of sensitive personal information to purposes that are "reasonably necessary and proportionate" to the purposes for which the information was collected or processed. Cal. Civ. Code § 1798.121(a). VMS must ensure that its own use and disclosure of GPS/geolocation data — including the disclosure to Meridian — is consistent with this standard. The DPA must restrict Meridian's processing of GPS/geolocation data to the specific purposes enumerated in the DPA and must prohibit Meridian from using GPS/geolocation data for any purpose beyond what is reasonably necessary and proportionate to the contracted analytics services.
We recommend that the DPA include a specific annex or schedule addressing sensitive personal information handling requirements. This annex should identify the specific categories of sensitive personal information (GPS/geolocation data) included in the data transfer, describe the permitted processing purposes, establish enhanced security measures applicable to sensitive personal information, and set forth any additional restrictions or limitations on use, retention, and disclosure.
3. Consumer Rights Facilitation.  The CCPA/CPRA grants California consumers a range of rights with respect to their personal information, including the right to access, the right to deletion, the right to correction, and the right to opt out of sales or sharing. VMS, as the business that collected the personal information, bears primary responsibility for receiving and responding to consumer rights requests. However, VMS's ability to fulfill these requests depends in part on Meridian's cooperation, particularly where personal information has been transferred to Meridian and is held in Meridian's systems.
The DPA should include provisions requiring Meridian to cooperate with VMS in responding to consumer rights requests from California consumers. Specific requirements should include:
•  A mechanism for VMS to forward consumer rights requests to Meridian for processing.
•  Defined response timelines for Meridian to act on forwarded requests (e.g., within five (5) business days of receipt of the request from VMS).
•  Operational procedures for the deletion, correction, or return of personal information held by Meridian in response to verified consumer requests.
•  An obligation on Meridian to notify Cloudvault and any other sub-processors of consumer rights requests and to ensure that such sub-processors comply with applicable deletion or correction obligations.
•  Recordkeeping requirements to document Meridian's handling of consumer rights requests and to facilitate VMS's own compliance reporting.
4. De-identification and Aggregation Standards.  As discussed in Section IV.C.1 above, the preservation of Meridian's service provider status under the CCPA/CPRA depends on ensuring that derivative analytics products developed by Meridian do not incorporate personal information in identifiable form. The DPA should require that Meridian use only de-identified or aggregated data — not personal information — in the development and commercialization of derivative analytics products.
The CCPA/CPRA establishes specific standards for de-identification. Under Cal. Civ. Code § 1798.140(m), "de-identified" information is information that "cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer," provided that the business (or, in this case, the service provider) that possesses the information:
(a) has implemented technical safeguards that prohibit re-identification of the consumer to whom the information may pertain;
(b) has implemented business processes that specifically prohibit re-identification of the information;
(c) has implemented business processes to prevent inadvertent release of de-identified information; and
(d) makes no attempt to re-identify the information.
The DPA should require Meridian to meet each of these de-identification requirements as a condition of using VMS-derived data in derivative analytics products. The DPA should also require Meridian to document its de-identification processes, to make such documentation available to VMS upon request, and to certify periodically that its de-identification processes continue to meet the CCPA/CPRA standard.
Aggregated data — defined under the CCPA/CPRA as information that relates to a group or category of consumers from which individual consumer identities have been removed and that is not linked or reasonably linkable to any consumer or household — represents an additional permissible basis for derivative product development. The DPA should define the aggregation standards applicable to Meridian's use of VMS data and should require Meridian to certify that aggregated data used in derivative products is not linked or reasonably linkable to any individual consumer.
E. Enforcement and Penalty Considerations
The CCPA/CPRA is enforced by both the California Attorney General and the California Privacy Protection Agency ("CPPA"), an independent agency established by the CPRA with rulemaking and enforcement authority. The CPPA is expected to assume primary enforcement responsibility upon completion of its rulemaking process.
Of particular significance to the VMS-Meridian arrangement is the CCPA's private right of action for data breach violations. Cal. Civ. Code § 1798.150. This provision authorizes California consumers to bring civil actions against businesses that fail to implement and maintain reasonable security procedures, where such failure results in unauthorized access, theft, or disclosure of non-encrypted or non-redacted personal information. Statutory damages range from $100 to $750 per consumer per incident, or actual damages, whichever is greater.
The potential statutory damages exposure in the context of the VMS-Meridian arrangement is substantial:
With approximately 112,000 California consumers potentially affected by a data breach involving VMS personal information held by Meridian, the maximum statutory damages exposure could reach approximately $84 million. This figure significantly exceeds Meridian's proposed $15 million aggregate liability cap in the DPA, and it does not account for additional actual damages, attorneys' fees, injunctive relief, or administrative penalties imposed by the California Attorney General or the CPPA.
This analysis strongly supports VMS's position that the DPA's liability provisions should either (a) exclude data breaches and unauthorized processing from the aggregate liability cap entirely (i.e., treat data protection liabilities as uncapped), or (b) establish a substantially higher cap for data protection-related liabilities that reflects the realistic range of statutory damages exposure. The current $15 million cap proposed by Meridian is inadequate to protect VMS's interests in light of the foregoing exposure analysis.
V. Federal Drivers' Privacy Protection Act (18 U.S.C. §§ 2721 *et seq.*)
A. Statutory Overview
The Drivers' Privacy Protection Act ("DPPA") was enacted by Congress in 1994 to restrict the disclosure of personal information obtained by state Departments of Motor Vehicles ("DMVs") in connection with motor vehicle records. The DPPA was adopted in response to growing concerns about the use and misuse of DMV-held personal information, including the sale of such information to commercial data brokers and its use in stalking and harassment.
The DPPA applies to any person who knowingly obtains, discloses, or uses personal information from a motor vehicle record for a purpose not permitted by the statute. 18 U.S.C. § 2722. The statute creates a tiered system of protections, distinguishing between "personal information" and "highly restricted personal information."
Personal Information. Under 18 U.S.C. § 2725(3), "personal information" is defined as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information." The statute does not expressly enumerate VINs as "personal information," but VINs serve as a gateway to identifying information about vehicle owners through their linkage to motor vehicle title and registration records maintained by state DMVs.
Highly Restricted Personal Information. Under 18 U.S.C. § 2725(4), "highly restricted personal information" includes an individual's photograph, Social Security number, and medical or disability information. Such information is subject to additional protections beyond those applicable to "personal information" generally.
Motor Vehicle Record. Under 18 U.S.C. § 2725(1), a "motor vehicle record" is defined as "any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles."
Permissible Uses. The DPPA enumerates fourteen permissible uses for which personal information from motor vehicle records may be disclosed. 18 U.S.C. § 2721(b). These permissible uses include, among others, use in connection with motor vehicle or driver safety (§ 2721(b)(1)), use by insurers in connection with underwriting and claims investigation (§ 2721(b)(6)), use for research activities with restrictions on individual identification (§ 2721(b)(5)), and use for any purpose specifically authorized by the individual (§ 2721(b)(13)).
B. Applicability to the VMS-Meridian Arrangement
1. Does VMS Data Derive from Motor Vehicle Records?.  The threshold applicability question under the DPPA is whether the personal information that VMS proposes to share with Meridian was "obtained" from a "motor vehicle record" within the meaning of the statute. This question requires careful examination of the data provenance of VMS's owner/lessee identification information.
Direct Data Collection. VMS collects vehicle telemetry and in-cabin sensor data directly from vehicles via the VantageLink system. This data is generated by vehicle sensors — GPS receivers, accelerometers, pressure sensors, occupancy sensors, and the like — and is transmitted to VMS's cloud infrastructure in real time. The vehicle-generated data itself is not obtained from state DMV records; it is created independently by the vehicle's onboard systems. Standing alone, this data stream does not implicate the DPPA.
VIN Linkage. However, the vehicle-generated data is linked to VINs, and VINs are linked to vehicle registration information that originates from state DMV records. The VIN is encoded in the vehicle's hardware and is transmitted as part of the telemetry data stream. The linkage between a VIN and the identity of a vehicle's registered owner or lessee is established through motor vehicle title and registration records maintained by state DMVs.
Connected Insights Opt-In Process. VMS's Connected Insights opt-in process requires vehicle owner/lessee identity verification. The method by which VMS verifies owner/lessee identity is a critical factual question for DPPA purposes. If VMS verifies owner/lessee identity through its own independent consumer registration process — for example, by collecting identity information directly from the consumer through a VantageLink account registration form — then the personal information associated with the owner/lessee may not be "obtained" from a motor vehicle record. In contrast, if VMS's data systems incorporate or cross-reference DMV-sourced registration data — including automated VIN-to-owner lookups using databases derived from state title or registration records — then at least a subset of the personal information in VMS's systems may fall within the DPPA's scope.
Analysis. The DPPA's applicability to the VMS-Meridian arrangement turns on this data provenance question, which we cannot resolve definitively on the basis of information currently available. We understand that VMS's Connected Services team, led by Marcus Chen (Vice President, Connected Services), manages the data ingestion and identity verification processes for the Connected Insights program, and that Diana Kowalski (Chief Privacy Officer) has oversight of the data governance implications. We recommend that VMS confirm with Mr. Chen and Ms. Kowalski the precise data provenance of owner/lessee identification information linked to VINs — specifically, whether VMS's systems incorporate, cross-reference, or derive any owner/lessee identity data from state DMV title or registration databases, or whether all such data is independently collected through VMS's own consumer-facing registration process.
If the investigation reveals that VMS does incorporate DMV-sourced data, even indirectly (e.g., through a third-party data vendor that aggregates registration data from state DMVs), the DPPA would apply to the subset of personal information derived from such records.
2. Permissible Use Analysis.  If the DPPA is determined to apply to any portion of the VMS data shared with Meridian, VMS's disclosure of VIN-linked personal information to Meridian must fall within one or more of the permissible uses enumerated in 18 U.S.C. § 2721(b). Three permissible uses are potentially applicable:
§ 2721(b)(1): Motor Vehicle or Driver Safety. This permissible use authorizes the disclosure of personal information for use "in connection with matters of motor vehicle or driver safety." If the analytics services provided by Meridian are framed as contributing to motor vehicle or driver safety — for example, through the development of safety-related insights, crash prevention algorithms, or driving behavior risk models — this permissible use may be available. However, the breadth of Meridian's proposed analytics activities, which extend beyond safety-related applications to general commercial analytics and derivative product development, may make it difficult to rely exclusively on this permissible use for all data transfers.
§ 2721(b)(12): Bulk Distribution with Consent. This permissible use authorizes the disclosure of personal information for bulk distribution for surveys, marketing, or solicitations, if the state has obtained the express consent of the person to whom such personal information pertains. This provision may be applicable in states where the vehicle owner/lessee has provided express consent through the Connected Insights opt-in process and where the relevant state has a mechanism for recording and communicating such consent to DMV data recipients. The practical applicability of this provision depends on the specific consent mechanisms in place in each state, which vary significantly.
§ 2721(b)(13): Individual Authorization. This permissible use authorizes the disclosure of personal information for "any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety." Additionally, the DPPA permits disclosure where the individual to whom the information pertains has provided express consent. The Connected Insights opt-in consent obtained from vehicle owners and lessees may satisfy this individual authorization provision, provided that the consent language expressly covers the disclosure of personal information to third-party data processors such as Meridian for analytics purposes.
Recommendation. VMS should review the Connected Insights opt-in consent forms to assess whether the consent language is sufficiently broad to cover disclosure to Meridian and to satisfy the individual authorization requirements of the DPPA. If the existing consent language is deficient, VMS should consider updating its consent forms to include an express authorization for disclosure to third-party analytics providers and data processors.
3. DPPA Penalties.  The DPPA provides for both criminal and civil penalties for violations.
Criminal Penalties. Under 18 U.S.C. § 2723, a person who knowingly obtains, discloses, or uses personal information from a motor vehicle record for a purpose not permitted by the statute is subject to a criminal fine. If the violation is committed with the intent to make a profit, the court may impose a fine of up to $5,000 per day for each day that the violation continues.
Civil Penalties. Under 18 U.S.C. § 2724, a person who knowingly obtains, discloses, or uses personal information from a motor vehicle record in a manner not authorized by the statute is liable to the individual to whom the information pertains. The individual may recover actual damages (but not less than liquidated damages of $2,500 per violation), punitive damages upon proof of willful or reckless disregard for the law, reasonable attorneys' fees, and other preliminary and equitable relief as the court may determine to be appropriate.
The DPPA's penalty provisions reinfor

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT

Record

Parties

Dates

Amounts